Cookie and Tracking Technologies Policy

Document code: RJ-LS-12

Version: 4.0

Version date: 22 September 2026

Effective date: 1 October 2026

Issued by: Ralph Jacobs SA (Pty) Ltd (reg. 2019/101093/07) and Ralph Jacobs NZ Limited (company no. 9334729) — see Where We Sell for which company sells to you

Supersedes: all earlier published versions of this document

This Policy explains how Ralph Jacobs uses cookies, pixels, tags, local storage, analytics tools, advertising tools and similar technologies on its websites, storefront domains, help centre, blog, media-hosting pages, campaign pages and digital channels.

The canonical legal hub is https://ralphjacobs.org.

Cookie-derived data may be personal information where it identifies a person or can reasonably be linked to a person. The Privacy Notice and Where We Sell apply to such processing.

Which law applies depends on which Ralph Jacobs company you are buying from and where you are.

For transactions with Ralph Jacobs SA (Pty) Ltd, POPIA and the Consumer Protection Act govern how we use cookies and send you marketing.

For transactions with Ralph Jacobs NZ Limited, the New Zealand Privacy Act 2020 and the Unsolicited Electronic Messages Act 2007 apply. Where goods are supplied to you in Australia, the Australian Privacy Act and Spam Act may also apply.

Where the GDPR, UK GDPR or ePrivacy rules apply to our processing, we comply with those in addition.

We use:

• strictly necessary cookies for security, cart, checkout, consent preferences, fraud prevention, bot protection and basic website operation;
• functional cookies for preferences and enhanced features;
• analytics cookies, pixels, tags and logs to understand how our website, storefront, help centre, blog and campaigns are used;
• advertising and marketing cookies, pixels, tags and conversion events for campaign measurement, abandoned-cart activity, audience creation, retargeting and targeted advertising; and
• security cookies and logs to detect abuse, errors, failed payments, suspicious behaviour and cyber risk.

These tools may collect or infer:

• IP address, device identifier, browser, operating system and approximate location;
• the domain or platform visited, referring source, campaign source and session identifiers;
• page views, clicks, searches, scrolls, cart events, checkout events and form interactions;
• account-creation, signup, consent-preference and marketing-preference events;
• email, SMS, WhatsApp or campaign delivery, open, click and response events where lawful and technically available; and
• security, fraud-prevention, bot-protection and error-log information.

If we add or remove a provider, this table changes and the version number goes up. Every version we have published is kept at ralphjacobs.org/versions/.

When you visit our site, our Meta advertising tools collect certain information about that visit and send it to Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland.

For that collection and transmission, Ralph Jacobs and Meta Ireland are joint controllers — meaning we are both responsible for it, and we have a written arrangement setting out which of us does what. In short:

• We are responsible for telling you that this happens, which is what this section does, and for implementing the tools correctly on our site.
• Meta Ireland is responsible for what it does with the information after it receives it, and for handling your access, correction, erasure, restriction and portability requests about the data it holds.
• Both of us are responsible for having a lawful basis for our own part of the processing, for the security of our own part, and for reporting a data breach that concerns our own part.

You can exercise your rights over the data Meta holds directly against Meta Ireland. What Meta does with it, the legal basis it relies on, and how to contact it are in Meta’s privacy policy at https://www.facebook.com/about/privacy. If you raise a request with us instead, we will pass it to Meta within seven days.

We also run pages on Facebook, Instagram, X, Pinterest, YouTube and LinkedIn. When you visit or interact with those pages, the platform processes your information under its own terms, not ours, and we have no control over that. We do see aggregated statistics about how our pages perform.

We do not set non-essential cookies before you consent, where consent is required.

Strictly necessary cookies are used without asking, because without them the site cannot operate, the checkout cannot be secured and your privacy choices cannot be remembered.

For everything else — analytics, advertising and embedded social content — you choose. You can accept all, reject all, or choose by category, and you can change or withdraw your choice at any time using the cookie preferences link in our website footer.

Rejecting non-essential cookies does not stop you buying from us and does not change the price you pay.

Your browser also lets you block or delete cookies. Blocking some of them may affect how the site works, including the checkout and your saved preferences.

Cookies, pixels and tags used for direct marketing, targeted advertising, behavioural profiling, conversion tracking, abandoned-cart messaging, lookalike and custom audiences, email, SMS and WhatsApp engagement tracking, and campaign attribution are used in line with POPIA, the Consumer Protection Act’s direct-marketing rules, the New Zealand Privacy Act and Unsolicited Electronic Messages Act where applicable, the Australian Spam Act and Privacy Act where applicable, and EU/UK cookie consent rules where applicable.

We keep opt-out and suppression records so that when you tell us to stop, we can prove we stopped.

How long a cookie lasts depends on the tool that sets it. Session cookies are deleted when you close your browser. Persistent cookies last for a set period, typically from a few days to two years, and the advertising and analytics providers in section 4 each publish their own retention periods.

You can delete them at any time through your browser or through our cookie preferences link.

The advertising and analytics providers in section 4 are international companies and process information outside South Africa and outside New Zealand. Where we send personal information across a border, we do so only on a lawful basis and with appropriate safeguards. Section 8.4 of our PAIA Manual sets out which system sends what, and where.

For anything about cookies, tracking or your privacy choices: privacy@ralphjacobs.org

You can also complain to the South African Information Regulator, the New Zealand Privacy Commissioner, the OAIC in Australia, or your own supervisory authority in the EU or UK. Contact details are in the PAIA Manual and the Privacy Notice.